{"record":{"id":"86552723e40eb1ce","repo":"hashicorp/packer","slug":"decode-envelope-signature-w","errorCode":null,"errorMessage":"decode envelope signature: %w","messagePattern":"decode envelope signature: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/dsse.go","lineNumber":63,"sourceCode":"\t\tenvelope.Signatures[0].Cert = string(signature.CertPEM)\n\t}\n\n\treturn envelope\n}\n\nfunc DecodeEnvelopePayload(envelope Envelope) ([]byte, error) {\n\tdecoded, err := base64.StdEncoding.DecodeString(envelope.Payload)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decode envelope payload: %w\", err)\n\t}\n\n\treturn decoded, nil\n}\n\nfunc DecodeEnvelopeSignature(signature EnvelopeSignature) ([]byte, error) {\n\tdecoded, err := base64.StdEncoding.DecodeString(signature.Sig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decode envelope signature: %w\", err)\n\t}\n\n\treturn decoded, nil\n}\n","sourceCodeStart":45,"sourceCodeEnd":68,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/dsse.go#L45-L68","documentation":"DecodeEnvelopeSignature base64-decodes the Sig field of an envelope signature. Packer wraps the base64 error with this message when signature.Sig is not valid standard base64, indicating a malformed signature component in the DSSE envelope.","triggerScenarios":"Calling DecodeEnvelopeSignature with an EnvelopeSignature whose Sig string is invalid standard base64 (bad characters, missing padding, empty); called by VerifyEnvelope and ensureBundleMatchesEnvelope during verification and bundle-consistency checks.","commonSituations":"A Sigstore bundle or envelope was hand-assembled or edited, the signature was extracted incorrectly (e.g. raw bytes pasted as hex or base64url), or the bundle/envelope pairing is corrupt so signatures don't decode.","solutions":["Regenerate the envelope/bundle from the signing tool so Sig is freshly produced standard base64","Confirm the signature is base64 (not hex or base64url) and re-encode with base64.StdEncoding if needed","Check that the bundle matches the envelope — ensureBundleMatchesEnvelope hits this too, so mismatched/transplanted signatures can carry bad data","Validate the whole JSON envelope structure and field integrity before verification"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func validSigBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil && s != \"\"\n}\n// before verification, for each signature:\n// if !validSigBase64(sig.Sig) { return errors.New(\"signature is not valid standard base64\") }","typeGuard":"func hasDecodableSignature(sig EnvelopeSignature) bool {\n\t_, err := base64.StdEncoding.DecodeString(sig.Sig)\n\treturn err == nil\n}","tryCatchPattern":"sigBytes, err := DecodeEnvelopeSignature(sig)\nif err != nil {\n\t// signature component corrupt: regenerate bundle/envelope from signer\n\treturn fmt.Errorf(\"rejecting malformed envelope signature: %w\", err)\n}","preventionTips":["Extract signatures with the signer tooling (which emits standard base64), not manual copy/paste","Don't mix encodings: hex or base64url signatures will fail StdEncoding","Keep bundle and envelope together — verify pairing to avoid corrupt/mismatched Sig fields","Sanity-check Sig decodes before persisting envelopes"],"tags":["attestation","dsse","base64","signature","go"],"backgroundTag":"base64-decode-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}